Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 27 Jul 2021 18:43:04 +0800
From:   Ming Lei <ming.lei@redhat.com>
To:     John Garry <john.garry@huawei.com>
Cc:     axboe@kernel.dk, osandov@fb.com, linux-block@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] blk-mq-sched: Fix blk_mq_sched_alloc_tags() error
 handling
Message-ID: <YP/jOJZTFM2llXyC@T590>
References: <1627378373-148090-1-git-send-email-john.garry@huawei.com>
 <YP/atlyuacbHF/sp@T590>
 <e0c47dfe-4774-358d-6e1d-22fa98865d57@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <e0c47dfe-4774-358d-6e1d-22fa98865d57@huawei.com>
Precedence: bulk

On Tue, Jul 27, 2021 at 11:30:00AM +0100, John Garry wrote:
> On 27/07/2021 11:06, Ming Lei wrote:
> > On Tue, Jul 27, 2021 at 05:32:53PM +0800, John Garry wrote:
> > > If the blk_mq_sched_alloc_tags() -> blk_mq_alloc_rqs() call fails, then we
> > > call blk_mq_sched_free_tags() -> blk_mq_free_rqs().
> > > 
> > > It is incorrect to do so, as any rqs would have already been freed in the
> > > blk_mq_alloc_rqs() call.
> > > 
> > > Fix by calling blk_mq_free_rq_map() only directly.
> > > 
> > > Fixes: 6917ff0b5bd41 ("blk-mq-sched: refactor scheduler initialization")
> > > Signed-off-by: John Garry <john.garry@huawei.com>
> > 
> > Not sure it is one fix, because blk_mq_free_rqs() does nothing when
> > ->static_rqs[] isn't filled, so 'Fixes' tag isn't needed, IMO.
> 
> I actually experimented by returning an error from blk_mq_sched_alloc_tags()
> -> blk_mq_alloc_rqs() at the function entry point, and it crashes:
> 
> [8.118419]
> ==================================================================
> [8.125677] BUG: KASAN: null-ptr-deref in blk_mq_free_rqs+0x170/0x380

OK, looks it is caused by un-initialized &tags->page_list, then it is fine
to mark it as fixes.

-- 
Ming